Advisories · Technology
e107.
Every CVE that names e107 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.1 Medium
e107 CMS before 2.3.13 Reflected XSS via search.php author Parameter
- e107
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
e107: Unsafe deserialization in install.php allows unauthenticated RCE via POP chain
- e107
- Insecure deserialization
- CVSS 10.0 CriticalCritical · CVSS 9+
e107: SQL injection in alt_auth plugin (otherdb / e107db backends) via login username
- e107
- SQL injection
- CVSS 9.8 CriticalCritical · CVSS 9+
e107 e107 - SQL Injection
- e107
- SQL injection
- CVSS 7.7 High
e107 Second-Order Code Execution via eval()-Based Deserialization in e_array::unserialize()
- e107
- Insecure deserialization
- CVSS 7.1 High
e107: Command Injection via shell expansion in ImageMagick resize destination path
- e107
- Command injection
- CVSS 6.5 Medium
e107: CSRF in comment.php moderation endpoints via token-optional validation in session_handler::check()
- e107
- Broken access control
- Cross-site request forgery (CSRF)
- CVSS 8.1 High
e107: Host Header Injection in e107 password reset enables phishing
- e107
- CWE-20
- CWE-807
- CVSS 6.5 Medium
e107: Broken Access Control in e107 comment edit allows cross-user comment modification
- e107
- Broken access control
- CVSS 4.3 Medium
e107: Server-Side Request Forgery (SSRF) in the remote file fetcher
- e107
- Server-side request forgery (SSRF)